Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2015-2077 Details

Description

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4	CVE	Exploit
http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4	CVE
http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/	CVE
http://news.lenovo.com/article_display.cfm?article_id=1929	CVE
https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/	CVE	Exploit
http://support.lenovo.com/us/en/product_security/superfish	CVE
https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339	CVE
http://www.kb.cert.org/vuls/id/529496	CVE	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/72693	CVE
http://www.securitytracker.com/id/1031779	CVE
http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish	CVE
http://www.us-cert.gov/cas/techalerts/TA15-051A.html	CVE	Third Party AdvisoryUS Government Resource
http://www.wired.com/2015/02/lenovo-superfish/	CVE
http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4	[email protected]	Exploit
http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4	[email protected]
http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/	[email protected]
http://news.lenovo.com/article_display.cfm?article_id=1929	[email protected]
https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/	[email protected]	Exploit
http://support.lenovo.com/us/en/product_security/superfish	[email protected]
https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339	[email protected]
http://www.kb.cert.org/vuls/id/529496	[email protected]	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/72693	[email protected]
http://www.securitytracker.com/id/1031779	[email protected]
http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish	[email protected]
http://www.us-cert.gov/cas/techalerts/TA15-051A.html	[email protected]	Third Party AdvisoryUS Government Resource
http://www.wired.com/2015/02/lenovo-superfish/	[email protected]

see all 26 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]

Affected Products

Product	Versions
komodia redirector sdk	All versions
CPE cpe:2.3:a:komodia:redirector_sdk:-:::::::* Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Dec 31, 2016	CVE Modified	[email protected]
Feb 28, 2015	CVE Modified	[email protected]
Feb 25, 2015	Modified Analysis	[email protected]
Feb 25, 2015	Initial Analysis	[email protected]